WhatsApp discovers spyware that infected with a call alone

This March 10, 2017 file photo shows the WhatsApp communications app on a smartphone in New York. WhatsApp says a vulnerability in its app let mobile phones be infected with sophisticated spyware with a missed in-app call alone.

Spyware crafted by a sophisticated group of hackers for hire took advantage of a flaw in the popular WhatsApp communications programme to remotely hijack dozens of phones, the company said late Monday.

The Financial Times identified the actor as Israel’s NSO Group, and WhatsApp all but confirmed the identification, describing the hackers as “a private company that has been known to work with governments to deliver spyware”. A spokesman for the Facebook subsidiary later said: “We’re certainly not refuting any of the coverage you’ve seen.”

The malware was able to penetrate phones through missed calls alone via the app’s voice-calling function, the spokesman said. An unknown number of people — an amount in the dozens at least would not be inaccurate — were infected with the malware, which the company discovered in early May, said the spokesman, who was not authorised to be quoted by name.

SCARY VULNERABILITY

John Scott-Railton, a researcher with the Internet watchdog Citizen Lab, called the hack “a very scary vulnerability”.

“There’s nothing a user could have done here, short of not having the app,” he said.

The spokesman said that the flaw was discovered while “our team was putting some additional security enhancements to our voice calls” and that engineers found that people targeted for infection “might get one or two calls from a number that is not familiar to them. In the process of calling, this code gets shipped.”

WhatsApp, which has more than 1.5 billion users, immediately contacted Citizen Lab and human -rights groups, quickly fixed the issue, and pushed out a patch. The spokesman said WhatsApp also provided information to US-law enforcement officials to assist in their investigations.

“We are deeply concerned about the abuse of such capabilities,” WhatsApp said in a statement.